           (testing "subject policies are checked"
             (doseq [[policy subject csr-file exception]
                     [["subject-hostname mismatch" "foo" "hostwithaltnames.pem"
-                      {:kind :hostname-mismatch
-                       :msg "Instance name \"hostwithaltnames\" does not match requested key \"foo\""}]
+                      #(= {:kind :hostname-mismatch
+                           :msg "Instance name \"hostwithaltnames\" does not match requested key \"foo\""}
+                          (select-keys % [:kind :msg]))]
                      ["invalid characters in name" "super/bad" "bad-subject-name-1.pem"
-                      {:kind :invalid-subject-name
-                       :msg "Subject contains unprintable or non-ASCII characters"}]
+                      #(= {:kind :invalid-subject-name
+                           :msg "Subject contains unprintable or non-ASCII characters"}
+                          (select-keys % [:kind :msg]))]
                      ["wildcard in name" "foo*bar" "bad-subject-name-wildcard.pem"
-                      {:kind :invalid-subject-name
-                       :msg "Subject contains a wildcard, which is not allowed: foo*bar"}]]]
+                      #(= {:kind :invalid-subject-name
+                           :msg "Subject contains a wildcard, which is not allowed: foo*bar"}
+                          (select-keys % [:kind :msg]))]]]
               (testing policy
                 (let [path (path-to-cert-request (:csrdir settings) subject)
                       csr  (io/input-stream (test-pem-file csr-file))]
                   (is (false? (fs/exists? path)))
-                  (is (thrown-with-slingshot? exception (process-csr-submission! subject csr settings)))
+                  (is (thrown+? exception (process-csr-submission! subject csr settings)))
                   (is (false? (fs/exists? path)))))))
 
           (testing "extension & key policies are not checked"

    (testing "when false"
      (let [settings (assoc settings :allow-duplicate-certs false)]
        (testing "throws exception if CSR already exists"
          (is (thrown-with-slingshot?
               {:kind :duplicate-cert
                :msg "test-agent already has a requested certificate; ignoring certificate request"}
               (process-csr-submission! "test-agent" (csr-stream "test-agent") settings))))

        (testing "throws exception if certificate already exists"
          (is (thrown-with-slingshot?
               {:kind :duplicate-cert
                :msg "localhost already has a signed certificate; ignoring certificate request"}
               (process-csr-submission! "localhost"
                                        (io/input-stream (test-pem-file "localhost-csr.pem"))
                                        settings)))
          (is (thrown-with-slingshot?
               {:kind :duplicate-cert
                :msg "revoked-agent already has a revoked certificate; ignoring certificate request"}
               (process-csr-submission! "revoked-agent"
                                        (io/input-stream (test-pem-file "revoked-agent-csr.pem"))
                                        settings))))))

(defn assert-no-autosign [whitelist subject]
  (testing subject
    (is (false? (autosign-csr? whitelist subject empty-stream [])))))

(defn contains-ext?
  "Does the provided extension list contain an extensions with the given OID."
